topic Re: Monitor Windows DHCP log file in Getting Data In

Monitor Windows DHCP log file

atifshaukat — Fri, 25 Feb 2011 18:09:23 GMT

I have setup input to index DHCP log files from remote server but unable to see any data being collected or collectors appearing on main page.

Under manage\Datainputs i have done following settings set source is Monitor a File or Directory Path to the server is something like this \servername\d$\abc.log

Re: Monitor Windows DHCP log file

ftk — Fri, 25 Feb 2011 21:53:08 GMT

What account are you running splunk as? Local System or a domain account? Since you are attempting to access an admin share (\servername\d$) the account splunk runs under has to be an admin on the remote server. You may be better off creating a share on your remote server and granting read access to the Splunk service account, or install a splunk regular or light forwarder on the remote server to forward the logs to your indexer.

Re: Monitor Windows DHCP log file

atifshaukat — Fri, 25 Feb 2011 23:47:33 GMT

splunk service is running as admin account and have full access to server so it is definitely no permission issue.

Re: Monitor Windows DHCP log file

ftk — Sat, 26 Feb 2011 04:50:17 GMT

Local admin or a domain account?